netlupaCheck a domain's DMARC record
DMARC tells the world what to do with emails that spoof your domain. Enter it to review its policy and reports.
How to read a DMARC record
DMARC is a TXT record at _dmarc.yourdomain.com that starts with «v=DMARC1» followed by tags separated by semicolons. For example:
- v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100; adkim=s
The most important tag is p, the policy: none (monitor only), quarantine (send to spam) or reject. A message passes DMARC if it passes SPF or DKIM and, in addition, the domain they validate is aligned with the sender the user sees.
With rua you will receive daily XML reports from the big providers listing every IP that sent email in your name: that is how you discover legitimate services that fail and spoofing attempts.
Each record in detail
Frequently asked questions
Can I go straight to «p=reject»?
Only if you are sure every sending service passes aligned SPF or DKIM. Otherwise you will lose legitimate email. The safe path is to start with «none», review the reports and tighten gradually.
Do subdomains need their own DMARC?
No: they inherit the main domain's policy (or the «sp» one, if set). You only need a separate record if you want a different policy for a subdomain.
What is my DKIM selector?
Open an email you sent, view its source or original headers and look for DKIM-Signature: the «s=» value is the selector and «d=» the domain. Google Workspace usually uses «google» and Microsoft 365 «selector1» and «selector2».
Is «~all» or «-all» better?
With DMARC in place the practical difference is small, because the DMARC policy decides. «-all» is stricter; «~all» is more forgiving with forwarding and forgotten services. Without DMARC, «-all» protects more.
I changed my DNS and the tool does not see it. Why?
DNS records are cached for as long as their TTL says (often one hour). Wait that long and check again. Also make sure the record is on the right name (for example, _dmarc.yourdomain.com for DMARC).
Do I need SPF and DMARC on a domain that sends no email?
Yes, it is highly recommended: publish «v=spf1 -all» and «v=DMARC1; p=reject;» so nobody can use that domain to send fake emails.
Do you store the domains I check?
No. We query public DNS at that moment, with our own resolver, and store neither the domain nor the result.